Vulnerability · Published Oct 7, 2024 · Assigned by GitHub_M

CVE-2024-47079Unauthorized usage of remote hardware module because of missing channel verification

Medium 6.4

In plain English

A medium-severity insufficient verification of data authenticity in firmware from meshtastic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.2%top 90.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Meshtastic is an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices. Meshtastic firmware is an open source firmware implementation for the broader project. The remote hardware module of the firmware does not have proper checks to ensure a remote hardware control message was received should be considered valid. This issue has been addressed in release version 2.5.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:25.10	meshtastic	no fix listed	UBUNTU-CVE-2024-47079
Ubuntu:26.10	meshtastic	no fix listed	UBUNTU-CVE-2024-47079

Affected products (as reported)

Vendor	Product	Versions
meshtastic	firmware	< 2.5.1

Weakness: CWE-345 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

References

https://github.com/meshtastic/firmware/security/advisories/GHSA-h8mh-p4r3-4jv7 x_refsource_CONFIRM